cve-2022-3736
Vulnerability from cvelistv5
Published
2023-01-25 21:39
Modified
2024-08-03 01:20
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
References
security-officer@isc.orghttps://kb.isc.org/docs/cve-2022-3736Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/docs/cve-2022-3736Vendor Advisory
Impacted products
Vendor Product Version
ISC BIND 9 Version: 9.16.12   <
Version: 9.18.0   <
Version: 9.19.0   <
Version: 9.16.12-S1   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T01:20:57.535Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "CVE-2022-3736",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/cve-2022-3736",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "BIND 9",
               vendor: "ISC",
               versions: [
                  {
                     lessThanOrEqual: "9.16.36",
                     status: "affected",
                     version: "9.16.12",
                     versionType: "custom",
                  },
                  {
                     lessThanOrEqual: "9.18.10",
                     status: "affected",
                     version: "9.18.0",
                     versionType: "custom",
                  },
                  {
                     lessThanOrEqual: "9.19.8",
                     status: "affected",
                     version: "9.19.0",
                     versionType: "custom",
                  },
                  {
                     lessThanOrEqual: "9.16.36-S1",
                     status: "affected",
                     version: "9.16.12-S1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Borja Marcos from Sarenet (with assistance by Iratxe Niño from Fundación Sarenet) for bringing this vulnerability to our attention.",
            },
         ],
         datePublic: "2023-01-25T00:00:00Z",
         descriptions: [
            {
               lang: "en",
               value: "BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "We are not aware of any active exploits.",
            },
         ],
         impacts: [
            {
               descriptions: [
                  {
                     lang: "en",
                     value: "By sending specific queries to the resolver, an attacker can cause `named` to crash.",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T06:03:10.975661Z",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               name: "CVE-2022-3736",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://kb.isc.org/docs/cve-2022-3736",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.37, 9.18.11, 9.19.9, or 9.16.37-S1.",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries",
         workarounds: [
            {
               lang: "en",
               value: "Setting `stale-answer-client-timeout` to `0` or to `off/disabled` will prevent BIND from crashing due to this issue.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2022-3736",
      datePublished: "2023-01-25T21:39:18.187Z",
      dateReserved: "2022-10-28T07:04:32.966Z",
      dateUpdated: "2024-08-03T01:20:57.535Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"9.16.12\", \"versionEndExcluding\": \"9.16.37\", \"matchCriteriaId\": \"FC5F91EF-B660-42FF-9B48-880299C9A128\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"9.18.0\", \"versionEndExcluding\": \"9.18.11\", \"matchCriteriaId\": \"92119B97-ADE6-47C0-B3E2-3B05C08A0B99\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"9.19.0\", \"versionEndExcluding\": \"9.19.9\", \"matchCriteriaId\": \"CB820E6D-F56C-4222-A3FF-3A02266FD68B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*\", \"matchCriteriaId\": \"3595F024-F910-4356-8B5B-D478960FF574\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*\", \"matchCriteriaId\": \"94661BA2-27F8-4FFE-B844-9404F735579D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*\", \"matchCriteriaId\": \"53593603-E2AF-4925-A6E6-109F097A0FF2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*\", \"matchCriteriaId\": \"751E37C2-8BFD-4306-95C1-8C01CE495FA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*\", \"matchCriteriaId\": \"CC432820-F1A2-4132-A673-2620119553C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:*\", \"matchCriteriaId\": \"F70347F2-6750-4497-B8F4-2036F4F4443A\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query.\\nThis issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.\"}, {\"lang\": \"es\", \"value\": \"El solucionador BIND 9 puede fallar cuando el cach\\u00e9 obsoleto y las respuestas obsoletas est\\u00e1n habilitados, la opci\\u00f3n `stale-answer-client-timeout` est\\u00e1 configurada en un entero positivo y el solucionador recibe una consulta RRSIG. Este problema afecta a las versiones de BIND 9, 9.16.12 a 9.16.36, 9.18.0 a 9.18.10, 9.19.0 a 9.19.8 y 9.16.12-S1 a 9.16.36-S1.\"}]",
         id: "CVE-2022-3736",
         lastModified: "2024-11-21T07:20:08.243",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"security-officer@isc.org\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
         published: "2023-01-26T21:15:57.940",
         references: "[{\"url\": \"https://kb.isc.org/docs/cve-2022-3736\", \"source\": \"security-officer@isc.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://kb.isc.org/docs/cve-2022-3736\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
         sourceIdentifier: "security-officer@isc.org",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2022-3736\",\"sourceIdentifier\":\"security-officer@isc.org\",\"published\":\"2023-01-26T21:15:57.940\",\"lastModified\":\"2024-11-21T07:20:08.243\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query.\\nThis issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.\"},{\"lang\":\"es\",\"value\":\"El solucionador BIND 9 puede fallar cuando el caché obsoleto y las respuestas obsoletas están habilitados, la opción `stale-answer-client-timeout` está configurada en un entero positivo y el solucionador recibe una consulta RRSIG. Este problema afecta a las versiones de BIND 9, 9.16.12 a 9.16.36, 9.18.0 a 9.18.10, 9.19.0 a 9.19.8 y 9.16.12-S1 a 9.16.36-S1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-officer@isc.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"9.16.12\",\"versionEndExcluding\":\"9.16.37\",\"matchCriteriaId\":\"FC5F91EF-B660-42FF-9B48-880299C9A128\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"9.18.0\",\"versionEndExcluding\":\"9.18.11\",\"matchCriteriaId\":\"92119B97-ADE6-47C0-B3E2-3B05C08A0B99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"9.19.0\",\"versionEndExcluding\":\"9.19.9\",\"matchCriteriaId\":\"CB820E6D-F56C-4222-A3FF-3A02266FD68B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*\",\"matchCriteriaId\":\"3595F024-F910-4356-8B5B-D478960FF574\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*\",\"matchCriteriaId\":\"94661BA2-27F8-4FFE-B844-9404F735579D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*\",\"matchCriteriaId\":\"53593603-E2AF-4925-A6E6-109F097A0FF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*\",\"matchCriteriaId\":\"751E37C2-8BFD-4306-95C1-8C01CE495FA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*\",\"matchCriteriaId\":\"CC432820-F1A2-4132-A673-2620119553C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:*\",\"matchCriteriaId\":\"F70347F2-6750-4497-B8F4-2036F4F4443A\"}]}]}],\"references\":[{\"url\":\"https://kb.isc.org/docs/cve-2022-3736\",\"source\":\"security-officer@isc.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://kb.isc.org/docs/cve-2022-3736\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.